CVE-2024-45605 Improper authorization on deletion of user issue alert notifications in sentry

What is CVE-2024-45605?

CVE-2024-45605 is a medium-severity missing authorization vulnerability in getsentry sentry, published on 17 Sep 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user delete the user issue alert notifications for arbitrary users given a know alert ID. A patch was issued to ensure authorization checks are properly scoped on requests to delete user alert notifications. Sentry SaaS users do not need to take any action. Self-Hosted Sentry users should upgrade to version 24.9.0 or higher. There are no known workarounds for this vulnerability.

Weakness: CWE-639

Which versions are affected by CVE-2024-45605?

3 open source packages ship an affected version, including sentry. It affects 1 product.

Products include Sentry Sentry.

How do I fix CVE-2024-45605?

Upgrade sentry to 24.9.0 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-45605 being exploited?

There is no known exploitation of CVE-2024-45605 in the wild and no public exploit code.

Other vulnerabilities in getsentry sentry

• CVE-2026-42354 Sentry: Improper authentication on SAML SSO process allows user identity linking Critical 9.1
• CVE-2026-27197 Sentry: Improper Authentication on SAML SSO process allows user identity linking Critical 9.1
• CVE-2021-47935 Sentry 8.2.0 Remote Code Execution via Pickle Deserialization High 8.7
• CVE-2023-39349 Sentry vulnerable to privilege escalation via ApiTokensEndpoint High 8.1
• CVE-2023-36826 Sentry vulnerable to improper authorization on debug and artifact file downloads High 7.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-54m3-95j9-v89j, PYSEC-2026-1910.